Deprecated: Function get_magic_quotes_gpc() is deprecated in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 99

Deprecated: The each() function is deprecated. This message will be suppressed on further calls in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 619

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 832

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839

Warning: Cannot modify header information - headers already sent by (output started at /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php:99) in /hermes/walnacweb04/walnacweb04ab/b2791/pow.jasaeld/htdocs/De1337/nothing/index.php on line 839
# Alert sources An alert source represents the connection between your tools (usually a monitoring system, a ticketing tool, or an application) and ilert. We often refer to alert sources as **inbound integrations**. ilert provides the following inbound integration options:

Tool integrations	These are pre-built integrations by ilert and work-out-of the box with your monitoring tools. If you're missing a tool, feel free to suggest an integration that you'd like to see in ilert.
Email integration	Forward emails to an alert source's email address to integrate with ilert.
Event API	Write your own integration using our easy-to-use Event API.
SMS integration	Send alerts to ilert via SMS.
Heartbeat monitoring	A heartbeat alert source will automatically create an alert if it does not receive a heartbeat signal from your app at regular intervals.

## Create an alert source 1. Go to **Alert sources** -> **Alert sources** and click **Create new alert source.**\\

2. Select your integration type in the search field and click **Next**.\\

3. Give your alert source a name, optionally assign teams, and click **Next**. 4. Select an **escalation policy** by creating a new one or assigning an existing one. \\

5. Select your [Alert grouping](#alert-grouping) preference and click **Continue setup**. You may click **Do not group alerts** for now and change it later.\\

6. The next page shows additional settings, such as custom alert templates or notification priority. Click on **Finish setup** for now. ## Alert template With alert templates, you can create your own template for the alert summary and alert details using preset fields from the integration. Moreover, our templating lets you extract links from the alert payload. Extracted links will be added to the links section of an alert. ### Custom alert summary and details template 1. Click on **Alert sources -> Alert sources** and choose an alert source to edit 2. Navigate to the section **Alert template** and check the boxes for **Alert summary** and/or **Alert details** 3. Create your custom template by selecting the **fields** you want use and entering any static text. \ The available fields are specific to the integration.\\

{% hint style="info" %} **Field colors and accessing raw fields** * Blue fields are preset fields provided by ilert. * Orange fields are extracted from past alerts in your account that were sent from the specific integration * Grey fields lets you extract any raw fields from the JSON payload by typing the name of the custom field, e.g. `custom_field`. You malso access nested fields and arrays, e.g. `custom_field.array_field[5].nested_field` {% endhint %} #### Testing your templates before saving Using the preview button you may try out your current template. By default, ilert will try to find one of the latest event payload's that was received by your alert source. If there is none present, we will render a fallback JSON doc, which you might alter as you like.

#### Using the template text syntax Your alert source template fields will start in text mode by default. In text mode you may use the **Insert data...** dropdown to help you add template variables quickly (see here to understand more about variables and how ilert automatically parses event data to offer additional variables to you) - the text syntax works like this:

Type	Sample	Description
Text	Some text	You may of course add generic text content to your liking
Variable	{{var}}	Extract content of the event and insert it. Note: there is no further sanitizing of the values
Accessing nested variables	{{ var.subfield.evenMore }}	Access sub fields
Accessing fields of an array	{{ var.arrayField[0].more }}	Access array contents

See ITL below to learn more about the templating language and its features for blocks, loops and functions: {% content-ref url="broken-reference" %} [Broken link](https://docs.ilert.com/alerting/configure-alerting/broken-reference) {% endcontent-ref %} {% embed url="" %} ### Alert links ilert can extract alert links from the alert payload. Extracted links will be added to the alert's links section. | Alert link template | Alert with extracted link | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | |

|  | ## Dynamic escalation policy routing With dynamic escalation policy routing, the escalation policy to be used will be determined based on the incoming alert, instead of always using the same escalation policy that is configured on the alert source. To extract the escalation policy [routing key](https://docs.ilert.com/on-call-management-and-escalations/escalation-policies#routing-key-optional) from the alert payload, add a routing key template in the section **Escalation -> Dynamic routing**.

In the above example, the field `Group key` from the alert payload will be used as the routing key. ## Notification priority and support hours ### Default notification priority By using notification priority, you can easily customise your alert notification based on your notification rules. 1. Click on **Alert sources -> Alert sources** and choose an alert source to edit 2. Scroll down to the section **Notification priority** and set your desired **Notification priority**

ilert provides different priority settings to customize your alerts. * **High (with escalation):** You will be notified based on your [high-priority notification rules](https://docs.ilert.com/alerting/notification-settings#define-notification-rules) and an alert can be escalated based on escalation policy. * **Low (no escalation):** You will be notified based on your low-priority notification rules and an alert cannot be escalated. ### Support hours based notification priority ilert also lets you dynamically set the notification priority based on the alert source's [support hours](https://docs.ilert.com/alerting/configure-alerting/support-hours). This lets you, for instance, use more obtrusive notification methods like phone calls outside of business hours and use not so obtrusive ones during business hours.

* **High during support hours, low priority otherwise:** During your support hours, you are notified based on your high priority notification rules. At all other times, you are notified based on your low priority notification rules. * **Low during support hours, high priority otherwise:** During your support hours, you are notified based on your low priority notification rules. At all other times, you are notified based on your high priority notification rules. If you select **High during support hours, low priority otherwise,** you can choose to **Raise priority of all pending alerts** by ticking the checkbox located under the support hour selection. All your pending alerts for the current alert source will be raised to "high" when your support hours **begin**. If you select **Low during support hours, high priority otherwise,** you can choose to **Raise priority of all pending alerts** by ticking the checkbox located under the support hour selection. All your pending alerts for the current alert source will be raised to "high" when your support hours **end**.

### Dynamic priority mapping With dynamic priority mapping, you can use alert fields to extract and map notification priority. This will overwrite default priority, if enabled. To enable dynamic priority mapping 1. Click on **Alert sources -> Alert sources** and choose an alert source to edit 2. Scroll down to the section **Notification priority** and check **Enable dynamic priority mapping** 3. Enter template to to extract the priority field from the alert payload 4. Add priority mappings. A priority mapping maps an extracted value from the alert payload to the ilert priority

{% hint style="info" %} ilert will fallback to the alert source's default priority, if a priority could not be extracted. {% endhint %} ## Event filter Sometimes flagging alerts as low priority is not enough and it is necessary to drop events completely. e.g. `Grafana DatasourceNoData` This is why you can configure one or multiple event filter groups for your alert source to process only desired events into alerts.

You may choose between properties of the known **ilert event payload** such as priority or summary, some more **advanced dynamic fields** like **trigger counts** which allow you to define your own rate limits as well as **schedules** and **support hours** to fine tune accept windows - and of course **custom payload fields**. If you wish for even more customization you can switch the UI into the code editor mode and get full access to the ICL, find out more about it here: {% content-ref url="" %} [ICL - ilert condition language](https://app.gitbook.com/s/684bnaGsqSFjESghpiiu/icl-ilert-condition-language) {% endcontent-ref %} ## Alert grouping Alert grouping helps you reduce noise by clustering related alerts within a defined time window or by allowing only one open alert at a time per source.

There are 5 types of alert grouping available: * Native integration based grouping * Time-based grouping * Grouping until accepted * Grouping until resolved * ilert AI similarity based grouping ### Native integration based grouping By default every alert source attempts to offer the best experience based on the features that the corresponding third party integration tool has available. Some tools offer more e.g. resolve events or proper alertKeys to group events, some tools offer a plain webhook without any additional context. ilert shows the integration features in the creation wizard:

Integrations such as Autotask, Jira, Grafana or Prometheus provide rich payloads which ilert automatically uses to identify alertKey and eventTypes, which are used to automatically group incoming events, if an unresolved alert with the same identifier is found. ### Time based grouping An alert source with alert grouping enabled will group together alerts triggered within the defined time window and create only one alert. Grouped alerts will show up as events in the alert's timeline. You can select relative time windows e.g. 2 minutes, 5 minutes, etc.

### Grouping until accepted / resolved Besides static relative windows you can also define action-based windows. By doing so alerts will be grouped until all alerts of the same alert source are accepted or resolved, before opening a new alert. (*You find these options at the end of the time-based selector*) ### ilert AI based similarity grouping Check out the link below to see more about AI based grouping: {% content-ref url="alert-sources/using-ilert-ai-for-alert-grouping" %} [using-ilert-ai-for-alert-grouping](https://docs.ilert.com/alerting/configure-alerting/alert-sources/using-ilert-ai-for-alert-grouping) {% endcontent-ref %}